Threat Intelligence Briefing

Global threat activity dropped sharply by 97.4% compared to the previous period, showing a return to baseline levels after an unusually high spike. Malware C2 remains the dominant category (30,926 events), with the US, Netherlands, and China as top origin countries. Nordic activity remains stable, with Finland showing slightly elevated brute-force attempts (62 events) compared to Sweden (48) and Denmark (19). The top threat IPs are predominantly SSH brute-force attacks originating from Russia, Bulgaria, and the Netherlands. Consider temporary rate-limiting for SSH traffic from ASNs associated with these brute-force clusters, particularly from NL and RU ranges. Deprioritize individual IP blocking unless patterns persist beyond 24 hours, as these are likely ephemeral attack sources.